Everardo Padilla Saca

**Name of the Vulnerable Software and Affected Versions** Apache Helix versions 0.8.0 through 1.0.4 **Description** The issue is related to a URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the Apache Helix UI component. This vulnerability affects all releases of Apache Helix from 0.8.0 to 1.0.4. The problem was caused by an improperly designed forward component for UI embedding. **Recommendations** For versions 0.8.0 through 1.0.4, upgrade to version 1.1.0 to fix the issue. As a temporary workaround, consider removing the forward component since it was improperly designed for UI embedding.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 1.10.12 **Description** The issue concerns a XSS exploit in Apache Airflow. The `origin` parameter passed to certain endpoints, such as `/trigger`, is vulnerable to this exploit. **Recommendations** For versions prior to 1.10.12, update to version 1.10.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints, such as `/trigger`, to minimize the risk of exploitation. Avoid using the `origin` parameter in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** uvicorn (affected versions not specified) **Description** The request logger in uvicorn is susceptible to ANSI escape sequence injection. When the package logs HTTP request details to the console or a log file, it can process crafted URLs with percent-encoded escape sequences, converting them into their single-character equivalent. This can have special meaning in terminal emulators, allowing attackers to pollute access logs and potentially interact with the terminal emulator displaying the logs. Attackers can exploit this by requesting URLs with crafted paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Uvicorn versions prior to 0.11.7 **Description** The issue allows attackers to exploit HTTP response splitting by adding arbitrary headers to HTTP responses or returning an arbitrary response body when crafted input is used to construct HTTP headers. This is due to CRLF sequences not being escaped in the value of HTTP headers. **Recommendations** For versions prior to 0.11.7, update to version 0.11.7 or later to resolve the issue. As a temporary workaround, consider validating and sanitizing all input used to construct HTTP headers to prevent the inclusion of malicious CRLF sequences.